2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader
Size 2.4MB
Sample261104-1t79jadx2w
SHA256 bb7fa9c946a4a9c566408eed2bf8853f5b2847c0e4fe121874ec2909bf03bf9a
MD5 47a76d7d9b52fcd0829b972a05788577
SHA1 cb77ff71343941259d21c6806eae3d3b1672ade6
SHA512 95fab8ba6057796fc0cf59dfb9fa0c6f82c64fea36d0f7472ff48ffb2e24e0346f12ece6e28c8ff7260e8839a69056ea08a7ffb7211071484f376afa0af119b4
SSDEEP 49152:kr0rVNuAZwZPRmch5VEtnUhs4sT8gPbNebJDmg27RnWGj:kA4Pv5D527BWG
TLSH
T16BC5BE21F3D78171DA5F167098797B794AB5AE448B288EC3D3807E1DB9326C1983336E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader

File Explorer

2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader

.exe 2.4MB

2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader

IMPHASH 0bc370f7d14c43331c71381d976ef02a
SHA256 bb7fa9c946a4a9c566408eed2bf8853f5b2847c0e4fe121874ec2909bf03bf9a
MD5 47a76d7d9b52fcd0829b972a05788577
SHA1 cb77ff71343941259d21c6806eae3d3b1672ade6
SHA512 95fab8ba6057796fc0cf59dfb9fa0c6f82c64fea36d0f7472ff48ffb2e24e0346f12ece6e28c8ff7260e8839a69056ea08a7ffb7211071484f376afa0af119b4
SSDEEP 49152:kr0rVNuAZwZPRmch5VEtnUhs4sT8gPbNebJDmg27RnWGj:kA4Pv5D527BWG
TLSH
T16BC5BE21F3D78171DA5F167098797B794AB5AE448B288EC3D3807E1DB9326C1983336E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

953272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\workspace\onlinetech\Build\Release\GameConsole-wt.pdb

ws2_32

gethostbyname ntohl WSACleanup gethostname WSAStartup

winmm

PlaySoundW timeGetTime

comctl32

InitCommonControlsEx

dinput8

DirectInput8Create

version

VerQueryValueW GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

kernel32

HeapFree GlobalFree GlobalAlloc FindResourceW SetLastError LockResource LoadResource lstrcpyW MulDiv GlobalUnlock GlobalLock lstrcmpW GlobalHandle ReleaseMutex SetThreadPriority lstrcatW SizeofResource OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot GetExitCodeProcess QueryInformationJobObject GetCurrentProcessId TerminateProcess ResumeThread AssignProcessToJobObject SetInformationJobObject CreateJobObjectW GetVersionExA SetEvent CompareStringA CompareStringW GetDateFormatW GetNumberFormatW GetLocaleInfoW GetSystemDefaultLangID GetUserDefaultUILanguage GetUserGeoID GetUserDefaultLCID GetFileSize CreateFileW CreateWaitableTimerW WriteFile SetWaitableTimer WaitForMultipleObjects CreateThread GetModuleFileNameA SetCurrentDirectoryW GetCurrentDirectoryW TerminateThread LoadLibraryA FileTimeToLocalFileTime SystemTimeToFileTime GetSystemTime ReadFile SetFilePointer SetEndOfFile CreateEventA FileTimeToSystemTime CreateMutexA GetCurrentDirectoryA GetFileAttributesExA CreateDirectoryA FindNextFileA DeleteFileA SetFileAttributesA FindFirstFileA DuplicateHandle FindFirstChangeNotificationW GetWindowsDirectoryA FormatMessageA CopyFileA MoveFileA LoadLibraryExA LocalFileTimeToFileTime QueryPerformanceFrequency QueryPerformanceCounter SetThreadAffinityMask FlushFileBuffers TlsGetValue TlsSetValue TlsAlloc ExitProcess FindResourceA OpenThread TerminateJobObject GetProcessTimes GetProcessId ResetEvent UnmapViewOfFile MapViewOfFile CreateFileMappingA OpenFileMappingA OpenMutexA OpenEventA SetFileTime DosDateTimeToFileTime GetFullPathNameA CreateProcessA CreateJobObjectA VirtualFreeEx ReadProcessMemory CreateRemoteThread WriteProcessMemory VirtualAllocEx GetDiskFreeSpaceExW GetDriveTypeW GetLogicalDriveStringsW GlobalMemoryStatus SetFileAttributesW CreateDirectoryW GetStartupInfoW HeapReAlloc VirtualQuery ExitThread GetDriveTypeA GetFileType LCMapStringA LCMapStringW GetCPInfo GetStringTypeA GetStringTypeW HeapDestroy HeapCreate IsBadWritePtr TlsFree HeapSize GetStdHandle UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW FindNextChangeNotification FindCloseChangeNotification WritePrivateProfileSectionW WritePrivateProfileStringW WaitForSingleObject CreateEventW GetCommandLineA SetHandleCount GetStartupInfoA GetTimeZoneInformation FindFirstFileW FindNextFileW FindClose FormatMessageW LocalFree GetFullPathNameW GetSystemTimeAsFileTime GetPrivateProfileStringA GetFileAttributesA WritePrivateProfileStringA GetFileAttributesW LoadLibraryExW FreeLibrary GetCurrentThreadId GetProcessHeap HeapAlloc FlushInstructionCache CopyFileW lstrlenA MultiByteToWideChar DeleteFileW RemoveDirectoryW ExpandEnvironmentStringsW LeaveCriticalSection EnterCriticalSection GetOEMCP SetStdHandle EnumSystemLocalesA IsValidLocale IsValidCodePage IsBadCodePtr SetEnvironmentVariableA Sleep GetPrivateProfileStringW CreateMutexW IsDebuggerPresent lstrlenW SetUnhandledExceptionFilter GetModuleHandleW LoadLibraryW GetTickCount GetCurrentThread GetThreadContext GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetModuleHandleA GetProcAddress GetCurrentProcess CreateFileA GetLastError WideCharToMultiByte GetCommandLineW InterlockedDecrement InterlockedIncrement GetModuleFileNameW CreateProcessW CloseHandle DeleteCriticalSection InitializeCriticalSection RaiseException GetVersionExW GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange RtlUnwind VirtualProtectEx GetVolumeInformationA DeviceIoControl DebugBreak IsBadReadPtr

user32

GetKeyState GetAsyncKeyState ScreenToClient MoveWindow EnumDisplayDevicesW GetCursor SetCursor SetCursorPos CharLowerBuffW MapDialogRect SetWindowContextHelpId CreateDialogIndirectParamW RegisterWindowMessageW GetWindowTextW CreateAcceleratorTableW GetClassNameW RedrawWindow SetFocus IsChild DestroyAcceleratorTable BeginPaint IntersectRect SetWindowsHookExW GetWindowThreadProcessId WaitForInputIdle UnhookWindowsHookEx FlashWindowEx LoadStringW ChangeDisplaySettingsW EnumDisplaySettingsW ValidateRect DrawTextExW EndPaint InvalidateRgn GetClientRect FillRect SetCapture SetTimer GetParent CheckRadioButton CheckDlgButton IsDlgButtonChecked GetSysColor SendDlgItemMessageW GetDlgItem GetTopWindow LoadImageW SetDlgItemTextW GetDlgItemTextW EnableWindow IsWindowEnabled IsWindowVisible GetWindowTextLengthW GetSystemMetrics CallWindowProcW MonitorFromPoint SystemParametersInfoW GetDesktopWindow DefWindowProcW UnregisterDeviceNotification RegisterDeviceNotificationW SendMessageTimeoutW GetActiveWindow GetFocus GetMonitorInfoW EqualRect SetRect CopyRect SetWindowRgn InvalidateRect GetUpdateRect SetWindowPlacement GetWindowPlacement IsZoomed SetWindowTextW KillTimer SetActiveWindow SetLayeredWindowAttributes IsRectEmpty CloseDesktop OpenDesktopW SendInput GetCursorPos LockSetForegroundWindow EnumChildWindows SetRectEmpty UpdateWindow GetMenu AdjustWindowRectEx PtInRect PostMessageA wsprintfA ReleaseCapture OffsetRect GetWindowLongW PostMessageW MonitorFromWindow GetWindowRect SetWindowPos TrackMouseEvent MessageBoxW CreateWindowExW RegisterClassExW DestroyWindow PeekMessageW LoadCursorW wsprintfW GetClassInfoExW IsWindow ShowWindow SetWindowLongW GetDC ReleaseDC FindWindowW IsIconic ShowWindowAsync SetForegroundWindow SendMessageW GetMessageW TranslateMessage DispatchMessageW GetQueueStatus FindWindowA FindWindowExA GetForegroundWindow EnumWindows PostQuitMessage UnregisterClassW CharUpperW CharNextW GetClassNameA GetLastInputInfo GetWindow MessageBoxA LoadIconW

gdi32

GetTextMetricsW GetTextExtentPoint32W CreateDIBSection SetDIBColorTable SetBkMode SetTextColor SetBkColor StretchBlt CreateSolidBrush GetStockObject GetObjectW BitBlt CreateCompatibleDC CreateCompatibleBitmap DeleteDC SelectObject GetDeviceCaps CreateRoundRectRgn CreateBitmapIndirect CreateBitmap DeleteObject CreateFontW EnumFontFamiliesExW

advapi32

RegCloseKey RegDeleteKeyW ImpersonateSelf RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RevertToSelf RegDeleteValueA RegDeleteKeyA RegSetKeySecurity RegSetValueExW RegEnumKeyExW RegNotifyChangeKeyValue FreeSid CheckTokenMembership AllocateAndInitializeSid CryptReleaseContext CryptDestroyHash CryptDestroyKey CryptSetKeyParam CryptDeriveKey CryptHashData CryptCreateHash CryptAcquireContextW CryptDecrypt RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegQueryInfoKeyA RegCreateKeyExA RegSetValueExA IsTextUnicode GetUserNameA

shell32

SHFileOperationA ShellExecuteExA SHGetSpecialFolderPathA ShellExecuteExW CommandLineToArgvW ord190 SHBrowseForFolderW SHGetPathFromIDListW ord155 SHGetFolderPathW ShellExecuteW

ole32

CreateStreamOnHGlobal OleLockRunning CoTaskMemAlloc CoTaskMemFree OleUninitialize StringFromGUID2 CoInitializeSecurity CoGetClassObject CoUninitialize CoInitialize OleInitialize CoInitializeEx StringFromCLSID CoCreateGuid CLSIDFromString CLSIDFromProgID CoCreateInstance CoSetProxyBlanket CoFreeUnusedLibraries

oleaut32

SysAllocStringLen LoadRegTypeLi LoadTypeLi SysStringLen SysAllocString VariantClear DispCallFunc VariantInit SysStringByteLen OleCreateFontIndirect VarBstrCmp SafeArrayGetVartype SafeArrayCopy VariantChangeType SafeArrayGetUBound SafeArrayGetLBound SafeArrayUnlock SafeArrayLock VariantCopyInd SafeArrayCreate SafeArrayDestroy SafeArrayRedim SysFreeString

shlwapi

PathStripPathA PathFileExistsA PathQuoteSpacesW PathIsDirectoryW PathAddBackslashW PathIsRelativeW StrStrIW PathGetArgsW PathUnquoteSpacesW PathFindOnPathW PathRemoveFileSpecW PathIsURLW PathMatchSpecW UrlCompareW UrlCanonicalizeW PathAppendW PathCombineW PathFileExistsW SHDeleteKeyW PathFindFileNameW PathAppendA

urlmon

URLDownloadToCacheFileA

d3d9

Direct3DCreate9

crypt32

CertFreeCertificateContext CryptQueryObject CryptMsgGetAndVerifySigner CertNameToStrA CryptMsgClose

wintrust

WinVerifyTrust

wininet

InternetOpenA InternetConnectA HttpOpenRequestA HttpQueryInfoA HttpSendRequestA InternetQueryOptionA InternetGetLastResponseInfoA HttpAddRequestHeadersA InternetOpenW InternetConnectW HttpOpenRequestW HttpSendRequestW InternetReadFile InternetCloseHandle InternetGetConnectedStateExW InternetAutodial

rpcrt4

UuidCreate

iphlpapi

GetAdaptersInfo

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.pecode

Size

68KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pccode

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

228KB

Virtual Size

227KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gchr

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

320KB

Virtual Size

319KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

672KB

Virtual Size

676KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_47a76d7d9b52fcd0829b972a05788577_amadey_coinminer_elex_smoke-loader

ws2_32

winmm

comctl32

dinput8

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

urlmon

d3d9

crypt32

wintrust

wininet

rpcrt4

iphlpapi

generic